logologo
  • How it works
  • Why It Matters
  • Statistics
  • Pricing
  • API
logologo
  • How it works
  • Why It Matters
  • Statistics
  • Pricing
  • API
HTPBE?

Structural PDF tamper detection API. Catches edits your KYC stack misses.

Product

  • How It Works
  • Why It Matters
  • Use Cases
  • Pricing

Developers

  • API Reference
  • GitHub/docs
  • Changelogv2.23.1

Resources

  • FAQ
  • Blog
  • Comparisons
  • Legal & Imprint

© 2024–2026 TMI Iurii Rogulia · VAT ID: FI29845875 · Made in Finland 🇫🇮

Status

Algorithm v2.23.1

Tool profile

Qt

Qt appears on both legitimate first-generation output and downstream re-save flows — context (the other tool on the same document) is what flips the signal.

Back to all statistics
Forensic verdict

Mixed signal

Based on 365 appearances across the HTPBE? corpus.

Modification rate
6%-42pp below baseline
Corpus baseline: 48%
Total appearances
365
1.7% of corpus
Modification rate
6%
-42pp below baseline
Role split
0%C/100%P
Creator vs Producer share of appearances

Corpus profile

How Qt shows up in HTPBE? corpus

Qt’s PDF backend ships with the Qt application framework and is used by a wide range of desktop apps that emit PDFs. It is also used by some PDF-editing utilities.

Qt as Producer is legitimate inside many desktop apps. The contextual signal is when Qt appears as the latest Producer on a document whose Creator points to an institutional generator — that producer/creator mismatch indicates a desktop-app re-save.

The signal
Qt as Producer is legitimate inside many desktop apps.

Role in the workflow

How Qt shows up in metadata

Every PDF carries a Creator (the application that produced the original document) and a Producer (the engine that wrote the PDF). The same tool can appear in either slot, with very different modification profiles.

CAs Creator · 0%
As Producer · 100%P
CAs Creator
  • Usage
    0
  • Modification rate
    0%
PAs Producer
  • Usage
    365
  • Modification rate
    6%
  • Avg file size
    111 KB

How to read this

The Creator slot typically reflects where a document started life. The Producer slot reflects whatever wrote the bytes — and is the field that gets overwritten when a PDF is opened, edited, and saved by a downstream tool.

A higher modification rate as Producer than as Creator usually means the tool is acting as a re-saver on documents that originated elsewhere. A higher rate as Creator points to fragile workflows around the original authoring app.

Name fingerprints

Also goes by

Different version strings and spellings observed for Qt in the wild. All are merged into the same canonical profile.

Qt 4.8.794.2%
Qt 5.5.11.6%
Qt 5.15.31.6%
Qt 5.15.131.1%
Qt 4.8.60.5%
Qt 4.8.6; modified using Pearl eSign™ v3.66 ©2021-2022 Add Pearlinfo Pvt Ltd0.5%
Qt 5.15.20.3%

Why variants matter

The same tool publishes itself under 7 different metadata strings — version bumps, locale tags, build IDs. We canonicalize them so the corpus reflects one identity, not noise.

Most common
Qt 4.8.7
94.2% of appearances
Variant spread
7 distinct strings
Long-tail share: 5.8%
Observed range
8 Mar 2023 → 20 May 2026

Distributions

What ships alongside Qt

The PDF versions Qt writes when acting as Producer, and the other tools that appear in the same documents.

PDF versions written

Most output is PDF 1.4 (99% of files where Qt is the Producer).

PDF 1.498.6%
PDF 1.71.2%
PDF 1.60.3%

Related profiles

Tools you’ll see next to Qt

Other tools that frequently share metadata with Qt in the same documents. Each card links to its own forensic profile.

C98% co-occurrence
wkhtmltopdf
Appearances368
Mod rate6%

Long tail

Notable observations

Smaller cuts of the Qt corpus — useful context, but treat each row as a single data point rather than a strong signal.

Digitally signed
1

PDFs carrying at least one digital signature

Pages parsed
740
Oldest observed
8 Mar 2023 — about 3 years ago

Secure your workflow

Create your account — API key on signup, free test environment on every plan.
From $15/mo. No sales call. Cancel any time.

Start free — close the structural fraud gapSee pricing
Read API docs →